From 5fa470189b46053078691d2d690391cb34c2c31d Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Sat, 3 Aug 2024 16:23:26 +0200 Subject: [PATCH 01/19] Add PR's to CHANGES --- CHANGES | 48 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 43 insertions(+), 5 deletions(-) diff --git a/CHANGES b/CHANGES index 1bb9b57e69..6d6b7de2ec 100644 --- a/CHANGES +++ b/CHANGES @@ -1,18 +1,56 @@ v3.0.13 - YYYY-MMM-DD --------------------- - - Reducing the scope of variables in a for loop + - New API function: set hostname for log + [PR #3203 - @airween] + - Fixing typo in Dockerfile + [PR #3189 - @bitbehz] + - Simplify checkout of submodules in GitHub workflows (with support for git describe) + [PR #3185 - @eduar-hte] + - Update README.md: use submodule and use benchmark tool + [PR #3182 - @airween] + - Improve performance of VariableOrigin instances + [PR #3164 - @eduar-hte] + - Update libinjection & Mbed TLS + [PR #3161 - @eduar-hte] + - chore: add PR template (v3) + [PR #3160 - @fzipi] + - Update to seclang-scanner changes introduced by Windows support + [PR #3146 - @eduar-hte] + - GitHub build & quality assurance workflow updates + [PR #3144 - @eduar-hte] + - Add link to Rust bindings in README + [PR #3141 - @rkrishn7] + - Remove cppcheck suppressions with line numbers in test/cppcheck_suppressions.txt + [PR #3134 - @eduar-hte] + - Add support to build libModSecurity v3 on Windows + [PR #3132 - @eduar-hte] + - fix: update submodule url + [PR #3128 - @fzipi] + - fix(rbl): typo in rbl check selector + [PR #3127 - @fzipi] + - fix: Changed 'equal_range()' + loop by 'find()' in resolveFirst() methods + [PR #3117 - @airween] + - Deleted redundant code in 'ModSecurity::serverLog(...)'. + [PR #3116 - @gberkes] + - doc: Update CHANGES + [PR #3101 - @airween] + - Reduce the scope of variables in a for loop [PR #3098 - @devzero2000] - - Replace obsolete macros + - Clean up 'return' never will be executed. + [PR #3096 - @gberkes] + - fix: Replace obsolete macros [PR #3095 - @airween] - - Change 'SecEngineStatus' to Off by default + - fix: Change 'SecEngineStatus' to Off by default [PR #3092 - @airween] - - Update bug-report-for-version-3-x.md + - chore: update bug-report-for-version-3-x.md [PR #3086 - @fzipi] - - Logical, syntax and cosmetic fixes on test cases + - test: Logical, syntax and cosmetic fixes on test cases [PR #3080 - @MirkoDziadzka, @airween] - Bump the C++ version from C++11 to C++17 [PR #3079 - @MirkoDziadzka] + - fix: makes uri decode platform independent + [PR #3016 - @M4tteoP] v3.0.12 - 2024-Jan-30 --------------------- From 20487300122aa688e93e8bdb83e6830e858d04e6 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Mon, 5 Aug 2024 09:32:40 +0200 Subject: [PATCH 02/19] Update CHANGES --- CHANGES | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGES b/CHANGES index 6d6b7de2ec..7530b398c4 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - remove 'this throw' call in transaction + [PR #3207 - @gberkes] - New API function: set hostname for log [PR #3203 - @airween] - Fixing typo in Dockerfile From ff303c761f1c3698b94832172b1e4c7b318a5757 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Tue, 6 Aug 2024 15:43:39 +0200 Subject: [PATCH 03/19] Add newest changes --- CHANGES | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index 7530b398c4..e7fc34a0a7 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,10 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Add cleanup methods to complete C based ABI + [PR #3209 - @eduar-hte] + - Build on macOS with Apple silicon (arm64) + [PR #3208 - @eduar-hte] - remove 'this throw' call in transaction [PR #3207 - @gberkes] - New API function: set hostname for log From 80dd45703b667e62dad77ba43a50bc6fedfe72ef Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Tue, 6 Aug 2024 17:37:52 +0200 Subject: [PATCH 04/19] Update CHANGES - added PR 3210 --- CHANGES | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGES b/CHANGES index e7fc34a0a7..6221e613b2 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Fixed shared files deadlock in a multi-threaded Windows application + [PR #3210 - @eduar-hte] - Add cleanup methods to complete C based ABI [PR #3209 - @eduar-hte] - Build on macOS with Apple silicon (arm64) From 5403b3d01cfdcd935a861e0e24677a5fe8b79430 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Wed, 7 Aug 2024 14:40:56 +0200 Subject: [PATCH 05/19] Update CHANGES; added newest PR's --- CHANGES | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGES b/CHANGES index 6221e613b2..39e448769c 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,14 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Refactor: used the init-statement to declare "pos" inside the + if statement + [PR #3214 - @gberkes] + - Refactor: moved 3 #include directives to the top of the file. + [PR #3213 - @gberkes] + - Fix SecRemoteRules regression test not to depend on a + specific error message + [PR #3211 - @eduar-hte] - Fixed shared files deadlock in a multi-threaded Windows application [PR #3210 - @eduar-hte] - Add cleanup methods to complete C based ABI From 13cce62b0b29e5e33af0a06b1b5403342a34e6b1 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Thu, 8 Aug 2024 17:52:14 +0200 Subject: [PATCH 06/19] Added PR #3212 --- CHANGES | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGES b/CHANGES index 39e448769c..e42141767a 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,9 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Do not assume ModSecurityIntervention argument to + transaction::intervention has been initialized/cleaned + [PR #3212 - @eduar-hte] - Refactor: used the init-statement to declare "pos" inside the if statement [PR #3214 - @gberkes] From 546ec8fe9a266af797c0db55139be007f6999729 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Thu, 8 Aug 2024 17:56:14 +0200 Subject: [PATCH 07/19] Added PR #3217 --- CHANGES | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGES b/CHANGES index e42141767a..0c5fcb4cf8 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,9 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - V3/sonarcloud replace this declaration by a structured + binding declaration + [PR #3217 - @gberkes] - Do not assume ModSecurityIntervention argument to transaction::intervention has been initialized/cleaned [PR #3212 - @eduar-hte] From 09980324a757e91fed21e1a35fc075507ab2517c Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Thu, 8 Aug 2024 21:03:10 +0200 Subject: [PATCH 08/19] Added PR #3114 --- CHANGES | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGES b/CHANGES index 0c5fcb4cf8..86f40a06e9 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - fix: Sonarcloud reported memleak fixes + [PR #3114 - @airween] - V3/sonarcloud replace this declaration by a structured binding declaration [PR #3217 - @gberkes] From c575dce3d35616fc062a9d2aaa6f415f9b7f0cfb Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Fri, 9 Aug 2024 17:40:33 +0200 Subject: [PATCH 09/19] Added PR 3218, 3219, 3220 --- CHANGES | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGES b/CHANGES index 86f40a06e9..318b16cd1e 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,13 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Creating a std::string with a null pointer\ + is undefined behaviour + [PR #3220 - @eduar-hte] + - Simplifiy configuration to build using std C++17 + [PR #3219 - @eduar-hte] + - Remove unnecessary dynamic casts + [PR #3218 - @eduar-hte] - fix: Sonarcloud reported memleak fixes [PR #3114 - @airween] - V3/sonarcloud replace this declaration by a structured From f42bc38f4c798dbecd3f2191f64699051ae522fa Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Tue, 13 Aug 2024 19:35:14 +0200 Subject: [PATCH 10/19] Update CHANGES --- CHANGES | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGES b/CHANGES index 318b16cd1e..85148611dd 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,11 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Prevent concurrent access to data in InMemoryPerProcess' + resolveXXX methods + [PR #3216 - @eduar-hte] + - Remove several string copies and unnecessary heap allocations + [PR #3222 - @eduar-hte] - Creating a std::string with a null pointer\ is undefined behaviour [PR #3220 - @eduar-hte] From c4b2723a4f0c1557dfcdfad71075ea187d71e419 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Wed, 14 Aug 2024 09:07:33 +0200 Subject: [PATCH 11/19] Added PR #3225 --- CHANGES | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGES b/CHANGES index 85148611dd..21e4ac8212 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - feat: Check if the MP header contains invalid character + [PR #3225 - @airween] - Prevent concurrent access to data in InMemoryPerProcess' resolveXXX methods [PR #3216 - @eduar-hte] From 746f4d7e80d88b96c644b36bb193127aade15a4a Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Wed, 14 Aug 2024 12:37:33 +0200 Subject: [PATCH 12/19] Added PR #3227 --- CHANGES | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index 21e4ac8212..012e08d5a8 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,7 @@ v3.0.13 - YYYY-MMM-DD --------------------- - + - Removed unnecessary lock to call acmp_process_quick in Pm::evaluate + [PR #3227 - @eduar-hte] - feat: Check if the MP header contains invalid character [PR #3225 - @airween] - Prevent concurrent access to data in InMemoryPerProcess' From 71bea86e917409ce7a5498e7b0b185d22f0d4cd0 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Wed, 14 Aug 2024 14:56:42 +0200 Subject: [PATCH 13/19] Added PR #3228 --- CHANGES | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index 012e08d5a8..d29e3bc961 100644 --- a/CHANGES +++ b/CHANGES @@ -1,5 +1,9 @@ v3.0.13 - YYYY-MMM-DD --------------------- + + - Replace usage of std::ctime, which is not safe in + multithread contexts + [PR #3228 - @eduar-hte] - Removed unnecessary lock to call acmp_process_quick in Pm::evaluate [PR #3227 - @eduar-hte] - feat: Check if the MP header contains invalid character From 094143801a1726c8d308340e1b85354de1404874 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Mon, 26 Aug 2024 21:48:46 +0200 Subject: [PATCH 14/19] Added PR #3232 --- CHANGES | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGES b/CHANGES index d29e3bc961..4a6970d80f 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Unit tests results should not be displayed in 'automake output' mode + [PR #3232 - @eduar-hte] - Replace usage of std::ctime, which is not safe in multithread contexts [PR #3228 - @eduar-hte] From 07fb5804157aaec02b868ede362fc67f6e0e59ef Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Wed, 28 Aug 2024 14:34:58 +0200 Subject: [PATCH 15/19] Added PR's #3233 and #3231 --- CHANGES | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index 4a6970d80f..15625b8d8b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,10 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Remove unnecessary heap allocated copies in Transformation actions + [PR #3231 - @eduar-hte] + - Removed multiple heap-allocated copies in Pm::init & parse_pm_content + [PR #3233 - @eduar-hte] - Unit tests results should not be displayed in 'automake output' mode [PR #3232 - @eduar-hte] - Replace usage of std::ctime, which is not safe in From 358618951ae9f9ef7c3fc4acdebe191c8c52981c Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Wed, 28 Aug 2024 14:37:56 +0200 Subject: [PATCH 16/19] Added PR #3240 --- CHANGES | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGES b/CHANGES index 15625b8d8b..53f517c4ed 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Lua::run: Move logging of str parameter to higher log level. + [PR #3240 - @frozenice] - Remove unnecessary heap allocated copies in Transformation actions [PR #3231 - @eduar-hte] - Removed multiple heap-allocated copies in Pm::init & parse_pm_content From 542a5ea35c90e2d833a8462cb864610feb2152c0 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Wed, 28 Aug 2024 16:08:23 +0200 Subject: [PATCH 17/19] Added PR #3243 --- CHANGES | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGES b/CHANGES index 53f517c4ed..ed9cdcad47 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ v3.0.13 - YYYY-MMM-DD --------------------- + - Adjust reference to modsecurity::utils::string::VALID_HEX + [PR #3243 - @eduar-hte] - Lua::run: Move logging of str parameter to higher log level. [PR #3240 - @frozenice] - Remove unnecessary heap allocated copies in Transformation actions From 2ab970be2e0703b779d8db6acb834783214b2981 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Mon, 2 Sep 2024 22:23:19 +0200 Subject: [PATCH 18/19] Finalize CHANGES --- CHANGES | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index ed9cdcad47..96045e9d64 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,4 @@ -v3.0.13 - YYYY-MMM-DD +v3.0.13 - 2024-Sep-03 --------------------- - Adjust reference to modsecurity::utils::string::VALID_HEX From b489fd3562ca001c9c38d9d32257414ffc91e35f Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Tue, 3 Sep 2024 07:45:09 +0200 Subject: [PATCH 19/19] Format fix Co-authored-by: Max Leske <250711+theseion@users.noreply.github.com> --- CHANGES | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index 96045e9d64..82c7e1b10a 100644 --- a/CHANGES +++ b/CHANGES @@ -23,7 +23,7 @@ v3.0.13 - 2024-Sep-03 [PR #3216 - @eduar-hte] - Remove several string copies and unnecessary heap allocations [PR #3222 - @eduar-hte] - - Creating a std::string with a null pointer\ + - Creating a std::string with a null pointer is undefined behaviour [PR #3220 - @eduar-hte] - Simplifiy configuration to build using std C++17